Skip to content

Commit

Permalink
refactor(chart): generalize option that specifies TLS is terminated u…
Browse files Browse the repository at this point in the history 
…pstream (#3243)

Signed-off-by: Kent Rancourt <[email protected]>
  • Loading branch information
@krancour
krancour authored Jan 10, 2025
1 parent 83115e5 commit 6abfa3f
Show file tree
Hide file tree
Showing 3 changed files with 6 additions and 6 deletions.
4 changes: 2 additions & 2 deletions charts/kargo/README.md
View file
Original file line number Diff line number Diff line change
Expand Up @@ -88,14 +88,14 @@ the Kargo controller is running.
| `api.env` | Environment variables to add to API server pods. | `[]` |
| `api.envFrom` | Environment variables to add to API server pods from ConfigMaps or Secrets. | `[]` |
| `api.probes.enabled` | Whether liveness and readiness probes should be included in the API server deployment. It is sometimes advantageous to disable these during local development. | `true` |
| `api.tls.enabled` | Whether to enable TLS directly on the API server. This is helpful if you do not intend to use an ingress controller or if you require TLS end-to-end. All other settings in this section will be ignored when this is set to `false`. | `true` |
| `api.tls.enabled` | Whether to enable TLS directly on the API server. This is helpful if you do not intend to use an ingress controller or if you require TLS end-to-end. All other settings in this section EXCEPT `terminatedUpstream` will be ignored when this is set to `false`. | `true` |
| `api.tls.selfSignedCert` | Whether to generate a self-signed certificate for use by the API server. If `true`, `cert-manager` CRDs **must** be present in the cluster. Kargo will create and use its own namespaced issuer. If `false`, a cert secret named `kargo-api-cert` **must** be provided in the same namespace as Kargo. | `true` |
| `api.tls.terminatedUpstream` | Whether TLS is terminated upstream, i.e. a load balancer, reverse-proxy, or an Ingress controller using a single wildcard cert is terminating it. Setting this to `true` forces all API server URLs to use HTTPS even if the Ingress (if applicable) or API server itself are listening for plain HTTP requests. | `false` |
| `api.permissiveCORSPolicyEnabled` | Whether to enable a permissive CORS (Cross Origin Resource Sharing) policy. This is sometimes advantageous during local development, but otherwise, should generally be left disabled. | `false` |
| `api.ingress.enabled` | Whether to enable ingress by creating an Ingress resource. By default, this is disabled. Enabling ingress is advanced usage. | `false` |
| `api.ingress.annotations` | Annotations specified by your ingress controller to customize the behavior of the Ingress resource. | `{}` |
| `api.ingress.ingressClassName` | If implemented by your ingress controller, specifies the ingress class. If your ingress controller does not support this, use the `kubernetes.io/ingress.class` annotation instead. | `nil` |
| `api.ingress.tls.enabled` | Whether to associate a certificate with the Ingress resource. | `true` |
| `api.ingress.tls.usesControllerCert` | Whether the ingress controller has been configured to terminate SSL using its own certificate instead of the certificate, if any, referenced by the Ingress resource. This is an uncommon configuration. | `false` |
| `api.ingress.tls.selfSignedCert` | Whether to generate a self-signed certificate for use with the API server's Ingress resource. If `true`, `cert-manager` CRDs **must** be present in the cluster. Kargo will create and use its own namespaced issuer. If `false`, a cert secret named `kargo-api-ingress-cert` **must** be provided in the same namespace as Kargo. The value in this field has no effect if `api.ingress.tls.enabled` is `false`. | `true` |
| `api.ingress.pathType` | You may want to use `Prefix` for some controllers (like AWS LoadBalancer Ingress controller), which don't support `/` as wildcard path when pathType is set to `ImplementationSpecific` | `ImplementationSpecific` |
| `api.service.type` | If you're not going to use an ingress controller, you may want to change this value to `LoadBalancer` for production deployments. If running locally, you may want to change it to `NodePort` OR leave it as `ClusterIP` and use `kubectl port-forward` to map a port on the local network interface to the service. | `ClusterIP` |
Expand Down
2 changes: 1 addition & 1 deletion charts/kargo/templates/_helpers.tpl
View file
Original file line number Diff line number Diff line change
Expand Up @@ -92,7 +92,7 @@ app.kubernetes.io/component: webhooks-server
{{- end -}}

{{- define "kargo.api.baseURL" -}}
{{- if or .Values.api.tls.enabled (and .Values.api.ingress.enabled (or .Values.api.ingress.tls.enabled .Values.api.ingress.tls.usesControllerCert)) -}}
{{- if or .Values.api.tls.enabled (and .Values.api.ingress.enabled .Values.api.ingress.tls.enabled) .Values.api.tls.terminatedUpstream -}}
{{- printf "https://%s" .Values.api.host -}}
{{- else -}}
{{- printf "http://%s" .Values.api.host -}}
Expand Down
6 changes: 3 additions & 3 deletions charts/kargo/values.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -146,10 +146,12 @@ api:
enabled: true

tls:
## @param api.tls.enabled Whether to enable TLS directly on the API server. This is helpful if you do not intend to use an ingress controller or if you require TLS end-to-end. All other settings in this section will be ignored when this is set to `false`.
## @param api.tls.enabled Whether to enable TLS directly on the API server. This is helpful if you do not intend to use an ingress controller or if you require TLS end-to-end. All other settings in this section EXCEPT `terminatedUpstream` will be ignored when this is set to `false`.
enabled: true
## @param api.tls.selfSignedCert Whether to generate a self-signed certificate for use by the API server. If `true`, `cert-manager` CRDs **must** be present in the cluster. Kargo will create and use its own namespaced issuer. If `false`, a cert secret named `kargo-api-cert` **must** be provided in the same namespace as Kargo.
selfSignedCert: true
## @param api.tls.terminatedUpstream Whether TLS is terminated upstream, i.e. a load balancer, reverse-proxy, or an Ingress controller using a single wildcard cert is terminating it. Setting this to `true` forces all API server URLs to use HTTPS even if the Ingress (if applicable) or API server itself are listening for plain HTTP requests.
terminatedUpstream: false

## @param api.permissiveCORSPolicyEnabled Whether to enable a permissive CORS (Cross Origin Resource Sharing) policy. This is sometimes advantageous during local development, but otherwise, should generally be left disabled.
permissiveCORSPolicyEnabled: false
Expand All @@ -165,8 +167,6 @@ api:
tls:
## @param api.ingress.tls.enabled Whether to associate a certificate with the Ingress resource.
enabled: true
## @param api.ingress.tls.usesControllerCert Whether the ingress controller has been configured to terminate SSL using its own certificate instead of the certificate, if any, referenced by the Ingress resource. This is an uncommon configuration.
usesControllerCert: false
## @param api.ingress.tls.selfSignedCert Whether to generate a self-signed certificate for use with the API server's Ingress resource. If `true`, `cert-manager` CRDs **must** be present in the cluster. Kargo will create and use its own namespaced issuer. If `false`, a cert secret named `kargo-api-ingress-cert` **must** be provided in the same namespace as Kargo. The value in this field has no effect if `api.ingress.tls.enabled` is `false`.
selfSignedCert: true
## @param api.ingress.pathType You may want to use `Prefix` for some controllers (like AWS LoadBalancer Ingress controller), which don't support `/` as wildcard path when pathType is set to `ImplementationSpecific`
Expand Down

0 comments on commit 6abfa3f

Please sign in to comment.